fix(deps): clear all dependency vulnerability advisories

Regenerated bun.lock to dedupe stale transitives to their patched
in-range versions, clearing every flagged advisory (incl.
CVE-2025-59433 / GHSA-vh25-5764-9wcr). Added a tmp override (fix is
outside external-editor's ^0.0.33 range) and pinned zod and obsidian
to their working versions so the security-only change does not drift
into breaking zod 4.4 / obsidian 1.13 bumps.

bun audit: no vulnerabilities found.

documentation/history/2026-06-17.md

@@ -13,3 +13,18 @@ ## Fixed issue #3 — Claude Desktop "not valid MCP server configurations"
 - `README.md` — MCP section now notes Claude Desktop needs the `mcp-remote` bridge and links to the integration guide.
 
 **Note:** the Claude Code config block (`type: url` + `url` + `headers`) is unchanged — that format is valid for Claude Code.
+
+## Cleared all dependency vulnerability advisories (`bun audit` → clean)
+
+GitHub/`bun audit` flagged ~18 transitive packages (qs, hono, @hono/node-server, path-to-regexp, ip-address, express-rate-limit, ajv, brace-expansion, minimatch, picomatch, fast-uri, flatted, handlebars, js-yaml, lodash, yaml, tmp, @conventional-changelog/git-client — incl. CVE-2025-59433 / GHSA-vh25-5764-9wcr). All are **transitive**: most via dev tooling (eslint, commitlint, commitizen, conventional-changelog, tailwind CLI); a subset (qs, hono, @hono/node-server, path-to-regexp, ip-address, express-rate-limit) ships via `@modelcontextprotocol/sdk`.
+
+**Root cause:** stale `bun.lock` froze old transitive versions; duplicate same-major copies (e.g. `minimatch@3.1.2` next to `3.1.5`) lingered even though patched versions already satisfied the consumers' ranges.
+
+**Fix:**
+- Regenerated `bun.lock` from scratch (`rm bun.lock && bun install`) — fresh resolution deduped every flagged transitive to its highest in-range (patched) version. Cleared all but `tmp`.
+- `overrides: { "tmp": "^0.2.7" }` in `package.json` — `tmp`'s fix (0.2.4+) is outside the `^0.0.33` that `external-editor` (commitizen/cz-customizable → inquirer) requests, so a fresh resolve can't reach it; the override forces it. Single major line, API-compatible (`fileSync`), dev-only.
+- Pinned `zod` `^4.1.13` → `4.1.13` and `obsidian` `latest` → `1.8.7`. These are unrelated to the CVEs but the floating ranges otherwise drift to `zod@4.4.3` / `obsidian@1.13.1` on a fresh resolve, which break the build (MCP-SDK ↔ zod 4.4 `ZodObject` type mismatch in `mcp-server.ts`; `obsidian` 1.13 requires an `override` modifier on `settings-tab.ts` `display()`). Held at working versions to keep this a security-only change.
+
+**Verification:** `bun audit` → "No vulnerabilities found"; `bun run tsc`, `bun run lint`, `bun run build`, and `bun test` (180 pass) all green.
+
+**Open follow-up:** upgrading `zod` (→4.4.x) and `obsidian` types (→1.13.x) is a separate, intentional task — both need small code fixes before un-pinning.

package.json

@@ -70,7 +70,7 @@
         "eslint-config-prettier": "^10.1.5",
         "eslint-plugin-obsidianmd": "0.1.9",
         "globals": "17.0.0",
-        "obsidian": "latest",
+        "obsidian": "1.8.7",
         "prettier": "^3.6.2",
         "tailwindcss": "4.1.17",
         "typescript": "^5.9.3",
@@ -79,6 +79,9 @@
     "dependencies": {
         "@modelcontextprotocol/sdk": "1.26.0",
         "immer": "11.0.1",
-        "zod": "^4.1.13"
+        "zod": "4.1.13"
+    },
+    "overrides": {
+        "tmp": "^0.2.7"
     }
 }